Turn your phone sideways
The slides are widescreen. Landscape fills the screen.
The basics, and everything you'll need for Tuesday and Thursday.
The basics, the words, and how attacks work. Today you just listen and absorb.
Bring a laptop. We set up a safe lab and find a real vulnerability together.
A friendly challenge. Everything in it, you will already have seen this week.
Your phone, your bank, social media, this centre. Cybersecurity is the job of protecting all of it from people who try to break in or steal. It's one of the biggest and best paid fields in the world today.
Watches, detects, and stops attacks. The guard on duty.
Breaks in on purpose, with permission, to find the holes first.
We learn the red side, because you can't defend against what you don't understand.
Every click is a request. The server reads it and decides what to answer. An attack is just a request the server didn't expect.
Proving your identity, logging in with a password or a code. Like showing your ID at the door.
Your permissions once you're inside. Like a ticket that decides which rooms you can enter.
Many bugs come from broken authorization: you're logged in, but you can still reach someone else's data. (That's OWASP A01.)
A weakness, a mistake left in a system.
The trick that abuses that weakness.
The thing you send to make it happen.
Looking around the target first.
Going from normal user to full control.
A public ID for a known vulnerability.
The one we'll do together is A03: Injection, better known as XSS.
Look around, find a way in.
Use the weakness you found.
Write it up clearly.
This is exactly what you'll do Tuesday, and compete with Thursday.
That's the whole mindset: don't just use the page, question it.
We put a little code in the search box, and the website ran it. That's a real attack, and on Tuesday you'll do it with your own hands.
A safe website, made to be hacked legally.
Lets you see and change what your browser sends.
Finds hidden pages a site doesn't link to.
All free. We install them together, or you set them up beforehand from the resources page.
Install WSL (Windows Subsystem for Linux) to get Linux tools inside Windows. A VM also works.
It runs everything you need already. Want Kali Linux? Just add a VM.
Run the tools directly, or keep them tidy in a VM like Kali.
A VM (VirtualBox, UTM, VMware) is just a second computer running safely inside your own. We'll keep it simple on Tuesday.
A company doesn't pay for a popup. It pays for a clear report: what you found, how to repeat it, why it matters, and how to fix it. On Thursday you'll write one, and AI can help you draft it fast.
Put your scripts and tools there. Keep it alive.
Solve something, then write how. A blog or your site.
A public record is what gets you hired or gets you clients.
Everything we do this week is on safe practice labs built for it. Attacking a real site without permission is a crime in Algeria (Penal Code 394 bis). The skill is the same, the only difference is permission, and that's the difference between a career and a criminal record.
Questions? Ask me anything.